[tests] Fix mjsunit/getters-on-elements

Give the IC one more chance to get itself into a state that's in
line with Turbofan's capabilities and the following assertOptimized
expectation.

BUG=v8:6101,v8:6325

Review-Url: https://codereview.chromium.org/2848193003
Cr-Commit-Position: refs/heads/master@{#45020}

src/runtime/runtime-test.cc

@@ -165,6 +165,7 @@ RUNTIME_FUNCTION(Runtime_DeoptimizeFunction) {
     return isolate->heap()->undefined_value();
   }
   Handle<JSFunction> function = Handle<JSFunction>::cast(function_object);
+  function->shared()->set_marked_for_tier_up(false);
 
   // If the function is not optimized, just return.
   if (!function->IsOptimized()) return isolate->heap()->undefined_value();

test/mjsunit/getters-on-elements.js

@@ -78,17 +78,38 @@ function base_getter_test(create_func) {
 
   foo(a);
   assertUnoptimized(foo);
+  // Smi and Double elements transition the KeyedLoadIC to Generic state
+  // here, because they miss twice with the same map when loading the hole.
+  // For FAST_HOLEY_ELEMENTS, however, the IC knows how to convert the hole
+  // to undefined if the prototype is the original array prototype, so it
+  // stays monomorphic for now...
   foo(a);
   foo(a);
   delete a[0];
 
   assertEquals(0, calls);
   a.__proto__ = ap;
+  // ...and later becomes polymorphic when it sees a second map. Optimized
+  // code will therefore inline the elements access, and deopt right away
+  // when it loads the hole from index [0].
+  // Possible solutions:
+  // - remove the convert_hole_to_undefined flag from the IC, to force it
+  //   into generic state for all elements kinds. Cost: slower ICs in code
+  //   that doesn't get optimized.
+  // - teach Turbofan about the same trick: for holey elements with the
+  //   original array prototype, convert hole to undefined inline. Cost:
+  //   larger optimized code size, because the loads for different maps with
+  //   the same elements kind can no longer be consolidated if they handle
+  //   the hole differently.
+  // - call "foo" twice after setting a.__proto__ and before optimizing it;
+  //   this is the simplest fix so let's do that for now.
   foo(a);
   assertEquals(1, calls);
-  optimize(foo);
   foo(a);
   assertEquals(2, calls);
+  optimize(foo);
+  foo(a);
+  assertEquals(3, calls);
   assertOptimized(foo);
 
   // Testcase: getter "deep" in prototype chain.

test/mjsunit/mjsunit.status

@@ -186,9 +186,6 @@
   #                  which makes the test useless.
   'big-object-literal': [PASS, ['mode == debug', SKIP]],
 
-  # BUG(v8:6101): This fails because of a hole deopt, need to investigate.
-  'getters-on-elements': [SKIP],
-
   # BUG(v8:6113).
   'es6/array-iterator-turbo': [SKIP],